Look twice.Find the gem.

AI agents and MCP servers, each published with its source and what the checks found.

Marketplace

  • Everything
  • AI agents
  • Apps
  • MCP servers
  • Templates
  • What people want
  • What changed this week
  • The verification standard
  • The ooruby Index
  • Servers that publish no source
  • Reliability guides
  • What the catalogue holds
  • Sell here

Our library

  • Everything, in one place
  • Guides
  • Glossary
  • Calculators
  • Checklists and cheat sheets
  • Community

ooruby

  • Home
  • For teams
  • Site status
  • Company projects
  • RSS feed

Verification records what our published tests found on a specific version at a specific date. It is not a warranty, and it does not certify that software is free of defects.

Rubricv1.0
AI agentsAppsMCP serversTemplatesWantedCommunityOur library
Sign inSell
Glossary
Security findings

RLS

Row-level security

Database rules that decide which rows a given user can see, enforced by the database itself.

Rather than trusting every query in the application to filter correctly, the database refuses to return rows the current user is not entitled to. It fails closed, and it keeps working when somebody adds a new query and forgets the filter.

Switched on is not the same as correct. In ooruby's own audit of apps built with Lovable (ooruby App Audit #1, on the research page), no sampled app left a table without row-level security in its migrations, yet some had policies that let any caller change or delete every row.

Why it matters

A policy that allows every caller everything leaves the switch reading on while the table is open to anyone, which is worse than off, because nobody looks again.

The mistake everyone makes

Testing with one account. Row-level security bugs are invisible until a second user exists.

Related terms

BOLA
When changing an identifier in a request lets you read somebody else's record.
Finding
One issue raised by verification, with a severity and a mapping to a standard weakness class.
Verified with findings
A listing that passed verification with issues recorded and published.
Previous
Retry storm
Next
Rubric

See RLS on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue